Retail chain Home Depot has discovered that in addition to the hacking of nearly 56 million users' credit card information, cyber attackers also stole over 53 million email addresses, investigators reported on Nov. 6.
Earlier in September, hackers broke into Home Depot's in-store payment system and gained access to its customer database through a vendor's billing account.
This, in turn, aided the hackers in installing malware on some of Home Depot's self-checkout terminals. The malware remained active on the retailer's network from April to September but has now been removed.
"We apologize for the frustration and anxiety this causes our customers and we thank you for your patience and support as we work through this issue," said the company.
While it has now come to light that email addresses were acquired by hackers, investigations also show that no "passwords, payment card information or other sensitive personal information" were stored in the stolen files where the customers' email addresses were found.
Even though there was no legal requirement, Home Depot has alerted U.S. and Canadian customers whose emails have been stolen. The retailer notified customers so that they would not fall prey to phishing attacks, which is commonplace when it comes to stolen emails.
With the hackers having access to a customer's credit card information and email, it may become easier for them to target unsuspecting users.
Home Depot is also offering credit monitoring to customers. The retailer has enhanced payment security systems for credit cards through additional encryption. However, the steps the retailer intends to take have not been revealed thus far.
"Home Depot's investigation, cooperation with law enforcement and efforts to further enhance its security measures are ongoing. The company does not anticipate further updates on the breach outside of its quarterly financial disclosures," the company stated.
